lkml.org 
[lkml]   [2010]   [Feb]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 11/12] mm: Take the RCU read lock in rmap_walk_anon
    Date
    rmap_walk_anon() does not use page_lock_anon_vma() for looking up and
    locking an anon_vma. One important difference between page_lock_anon_vma()
    and rmap_walk_anon() is that the page_lock_anon_vma() takes the RCU lock
    before the lookup so that the anon_vma does not disappear. There does not
    appear to be locking in place that prevents the anon_vma disappearing before
    the spinlock is taken.

    This patch puts a rcu_read_lock() around the anon_vma lookup similar to
    what page_lock_anon_vma() does to prevent an accidental use-after-free.

    Signed-off-by: Mel Gorman <mel@csn.ul.ie>
    ---
    mm/rmap.c | 7 ++++++-
    1 files changed, 6 insertions(+), 1 deletions(-)

    diff --git a/mm/rmap.c b/mm/rmap.c
    index b468d5f..fb695d3 100644
    --- a/mm/rmap.c
    +++ b/mm/rmap.c
    @@ -1233,9 +1233,10 @@ static int rmap_walk_anon(struct page *page, int (*rmap_one)(struct page *,
    * This needs to be reviewed later: avoiding page_lock_anon_vma()
    * is risky, and currently limits the usefulness of rmap_walk().
    */
    + rcu_read_lock();
    anon_vma = page_anon_vma(page);
    if (!anon_vma)
    - return ret;
    + goto out_rcu_unlock;
    spin_lock(&anon_vma->lock);

    /*
    @@ -1256,6 +1257,10 @@ static int rmap_walk_anon(struct page *page, int (*rmap_one)(struct page *,

    out_anon_unlock:
    spin_unlock(&anon_vma->lock);
    +
    +out_rcu_unlock:
    + rcu_read_unlock();
    +
    return ret;
    }

    --
    1.6.5


    \
     
     \ /
      Last update: 2010-02-12 13:05    [W:0.025 / U:0.772 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site